500 addresses. Four consecutive blocks. 594 BTC gone. That's not a hack. That's a harvest.
The wallets were offline. The chips were marketed as secure. The seed phrases never left the devices. And yet, on July 30, one entity reached into 500 Coldcard-generated wallets and drained them like an automated pipeline. No phishing. No malware. No exchange breach. The flaw was baked into the hardware wallet itself — a random number generator that quietly produced seeds with roughly 72 bits of entropy instead of the expected 128.
The yield didn't save anyone here. Nothing did. The entropy was the lie, and the victims paid 594 BTC to learn it.
This wasn't an exchange hack where a hot wallet gets drained by a phishing attack. This was the foundational promise of self-custody: my keys, my coins, my device, my security. When the device itself betrays that promise, the entire architecture of trust changes.
Coldcard has always been the bitcoin maxi's weapon of choice. Air-gapped. Open-source. Obsessively focused on single-purpose security. Coinkite built a reputation on the idea that private keys could live in a sealed silo, untouchable by the internet's grime. That reputation took a direct hit this week.
Here's what broke. Seeds generated on Mk3 devices running firmware 4.0.1 or later — that's everything since March 2021 — carry roughly 72 bits of entropy. Mk4 and Mk5 devices are affected before firmware 5.6.0. The Q device is affected before 1.5.0Q. TAPSIGNER, OPENDIME, and SATSCARD use a different codebase and are not affected.
Atlas21's on-chain analysis identified the blast radius. 500 addresses swept in four blocks. The median loss was 0.41 BTC per address. 110 victims lost more than 1 BTC each. The largest single address drained 29.9 BTC. This is not a theoretical vulnerability. This is a body count.
Coinkite's recommended response: migrate to new seeds on unaffected devices or firmware versions, add a BIP-39 passphrase, send test transactions before moving the full balance. Technically sound advice. Operationally fragile. The entire sequence depends on users backing up correctly, verifying derived addresses, and not making a single mistake during the migration. In my experience auditing recovery processes, the highest-risk moment in any wallet migration is the gap between "old seed retired" and "new seed verified." That's where funds get lost to user error, not to attackers.
Now let me get into the core math, because this matters more than the headlines suggest.
Seventy-two bits is not 128 bits. But here's the thing most people miss: 2^72 is still an enormous number. Brute-forcing a single 72-bit key with random guessing would require an impractical amount of compute. The attacker didn't brute-force anything. They didn't sit at a cluster trying to crack 500 private keys one by one. The four-block sweep window proves that.
Let me put those 72 bits in perspective with something I learned during my years building data pipelines for on-chain analysis. When Python's random module was used for key generation years ago, the PRNG state was large — but the seed was often time-based. Early Bitcoin thefts in 2011 traced back to wallets generated with timestamp-derived seeds. The same failure class repeats across the industry. Coldcard is just the latest name on the list.
Four blocks. That's roughly 40 to 60 minutes. Five hundred addresses, each requiring a private key derivation, a transaction build, and a broadcast — all executed in a tight, programmatic sequence. That's not a hacker with a lucky guess. That's a pipeline. The wallet history tells the real story: an automated scan identified vulnerable addresses, a key-recovery algorithm regenerated the private keys from the compromised entropy source, and a batching script signed and broadcasted every transaction in rapid succession.
This pattern is consistent with what I've seen in previous large-scale sweeps. When a single entity moves hundreds of addresses in consecutive blocks, the preparation happened months earlier. The attacker didn't discover this vulnerability on July 29 and execute on July 30. They likely found the weak entropy source, built a monitoring system, accumulated a list of exposed addresses over time, and waited for the optimal moment to strike. July 30 was extraction day, not discovery day.
And here's the uncomfortable part: the compromised firmware extends back to March 2021. That's over three years of users generating seeds on affected hardware. The 500 swept addresses are the confirmed casualties, but "confirmed" is not the same as "complete." There may be vulnerable addresses still sitting in cold storage, untouched, waiting to be drained.
The affected product range is also worth noting. Mk3, Mk4, Mk5, and Q — multiple product lines, multiple years, all sharing the same entropy deficiency. That's not a one-off coding mistake. That's a systematic RNG implementation flaw that survived across hardware generations and firmware releases. A single oversight, sure, but one that went unnoticed for years. That raises an obvious question: what else in the firmware is quietly compromised?
Every single target was a single-signature address. No multi-sig. No Taproot. That's a data point, but it's not a clean bill of health for those script types. Correlation is not causation. The attacker targeted standard single-sig paths because that's the most common wallet configuration and the easiest to batch-derive from a vulnerable seed. A multi-sig wallet built on a weak-entropy seed is still a multi-sig wallet standing on a broken foundation. The fact that the sweep didn't touch one doesn't prove immunity; it proves the attacker optimized their extraction strategy.
BTC didn't move on the news. Still trading near $64,000. That's correct market pricing — this is a localized security failure, not a Bitcoin network failure — but it's short-sighted. Floor prices don't crash in a hardware wallet incident, but trust does. Trust is the slow-moving asset you can't chart, and self-custody is a narrative built on the assumption that properly used hardware wallets are impenetrable.
That assumption is now formally fiction.
And stop pretending this is a Coinkite-only problem. Every hardware vendor's RNG deserves the same scrutiny now. The security theater that says "offline device equals safe device" needs to die.
The migration advice deserves scrutiny. Coinkite suggests generating new seeds on unaffected devices, adding a BIP-39 passphrase, and testing with small amounts. Sensible steps. But users who generate that passphrase or new seed on the same compromised hardware are just layering confidence onto a rotten foundation. If the RNG is compromised, everything derived from it is compromised. The passphrase doesn't fix entropy; it only adds a final layer of user-supplied randomization. If a user picks a weak or repeated passphrase, the protection collapses. I've seen this failure mode before in the audits I've run: people reach for the crypto equivalent of a hardware token, then use "password123" as the additional factor.
Let me also flag the disclosure process. Coinkite has been relatively transparent — publishing an advisory, listing affected versions, recommending migration paths — but the formal technical review is still pending. That's the next signal to watch. If the review exposes a specific RNG source failure, expect a wave of independent audits against other hardware wallets that use similar components. The industry has seen this movie before: one device's entropy bug becomes the catalyst for a broader security reckoning.
There's also the legal dimension. Consumer protection agencies in the US and Europe have taken an interest in crypto self-custody products. A claim that hardware wallets are "unhackable" followed by a 594 BTC theft is exactly the kind of mismatch that attracts regulators. Coinkite's reputation might survive, but the hardware wallet industry as a whole just gained a regulatory tailwind it didn't want.
What happens next? The formal technical review. The disclosure of the exact RNG flaw. The possibility of additional victim addresses surfacing. And the market's slow recognition that offline key storage alone doesn't guarantee security — the private key's birth is the critical moment, and if entropy fails at birth, everything downstream is just decoration.
In the wild, data doesn't lie. The 594 BTC got moved in four blocks because the seeds were predictable. The question now is how many more seeds are still out there, and who's building the next sweep.
Coldcard users on affected firmware: migrate now. Don't wait for the formal review. Don't wait for the luxury of a perfect migration window. Every day a vulnerable seed stays in active use is a block waiting to be swept.
The yield didn't save you. The air gap didn't save you. The only thing that can save you now is moving to a proven entropy source — and treating every seed born before today's fix as contaminated.
As for the rest of the market: watch the migration volumes. If you see a spike in wallet-to-wallet transfers from single-sig to multi-sig or Taproot addresses over the next few weeks, that's the real signal — not the headlines, not the panic, but the movement of assets away from broken assumptions.
Hardware wallets are still the best self-custody option we have. But "best option" and "absolute security" are two different claims. The 594 BTC makes that distinction painfully clear.